@tinycloud/mcp 0.1.0-beta.2

package/generated/mcp-facts.json

@@ -0,0 +1,148 @@
+{
+  "schemaVersion": 1,
+  "tools": [
+    {
+      "name": "tinycloud_account_applications_list",
+      "operationId": "tinycloud.account.applications.list",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_account_spaces_list",
+      "operationId": "tinycloud.account.spaces.list",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_auth_capabilities",
+      "operationId": "tinycloud.auth.capabilities",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
+    {
+      "name": "tinycloud_auth_import",
+      "operationId": "tinycloud.auth.import",
+      "operationVersion": 1,
+      "effects": [
+        "local_write"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
+    {
+      "name": "tinycloud_auth_request",
+      "operationId": "tinycloud.auth.request",
+      "operationVersion": 1,
+      "effects": [
+        "local_write"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
+    {
+      "name": "tinycloud_auth_status",
+      "operationId": "tinycloud.auth.status",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key",
+        "unauthenticated"
+      ],
+      "sensitiveOutput": false
+    },
+    {
+      "name": "tinycloud_kv_get",
+      "operationId": "tinycloud.kv.get",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_kv_list",
+      "operationId": "tinycloud.kv.list",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_secrets_get",
+      "operationId": "tinycloud.secrets.get",
+      "operationVersion": 1,
+      "effects": [
+        "read",
+        "local_write"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_status",
+      "operationId": "tinycloud.status.get",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key",
+        "unauthenticated"
+      ],
+      "sensitiveOutput": false
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@tinycloud/mcp",
+  "version": "0.1.0-beta.2",
+  "description": "TinyCloud delegated operations MCP server",
+  "author": "TinyCloud, Inc.",
+  "license": "EGPL",
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "tinycloud-mcp": "./bin/tinycloud-mcp"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    },
+    "./tools": {
+      "types": "./dist/tools.d.ts",
+      "import": "./dist/tools.js",
+      "require": "./dist/tools.cjs"
+    },
+    "./results": {
+      "types": "./dist/results.d.ts",
+      "import": "./dist/results.js",
+      "require": "./dist/results.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "bin",
+    "generated",
+    "skills"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "bun run build && bun scripts/test.ts && bun run check:generated",
+    "test:stdio": "bun run build && bun test src/stdio.test.ts",
+    "typecheck": "tsc -p tsconfig.json",
+    "generate": "bun scripts/generate.ts",
+    "check:generated": "bun scripts/generate.ts --check"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/server": "2.0.0-beta.4",
+    "@tinycloud/operations": "0.1.0-beta.2"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "2.0.0-beta.4",
+    "@types/node": "^20",
+    "tsup": "^8.0.0",
+    "typescript": "^5.9.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tinycloudlabs/web-sdk"
+  }
+}

package/skills/tinycloud-delegated-secrets/SKILL.md

@@ -0,0 +1,86 @@
+# TinyCloud delegated exploration and secrets
+
+Use the TinyCloud MCP tools as a resumable authority workflow. Never ask the
+user to paste a secret value, private key, token, or delegation credential into
+chat.
+
+<!-- BEGIN GENERATED TINYCloud operation facts -->
+The following facts are generated from `@tinycloud/operations/operations.json`:
+
+- `tinycloud_account_applications_list` -> `tinycloud.account.applications.list@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_account_spaces_list` -> `tinycloud.account.spaces.list@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_auth_capabilities` -> `tinycloud.auth.capabilities@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
+- `tinycloud_auth_import` -> `tinycloud.auth.import@1`; effects: local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
+- `tinycloud_auth_request` -> `tinycloud.auth.request@1`; effects: local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
+- `tinycloud_auth_status` -> `tinycloud.auth.status@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key, unauthenticated; sensitive output: no.
+- `tinycloud_kv_get` -> `tinycloud.kv.get@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_kv_list` -> `tinycloud.kv.list@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_secrets_get` -> `tinycloud.secrets.get@1`; effects: read, local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_status` -> `tinycloud.status.get@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key, unauthenticated; sensitive output: no.
+<!-- END GENERATED TINYCloud operation facts -->
+
+<!-- BEGIN GENERATED TINYCloud operations coverage -->
+Coverage is generated from the Commander registration ledger; legacy commands are not MCP tools.
+
+- 1 migrated registration(s).
+- 1 partially migrated registration(s).
+- 111 legacy registration(s) remain Commander-owned.
+- `auth import [source]` → `tinycloud.auth.import@1` (partially-migrated; remaining legacy inputs: v1 delegation artifact, v1 permission artifact without command, bare portable delegation, stored delegation wrapper, cross-user delegation persisted with activated=false).
+- `secrets get <name>` → `tinycloud.secrets.get@1` (migrated).
+<!-- END GENERATED TINYCloud operations coverage -->
+
+## Account and KV exploration
+
+1. A fresh `delegate-session` profile must first bootstrap its session through
+   the CLI: emit one exact `tc auth request --cap ...` artifact, have the owner
+   grant that artifact, and import the result with `tc auth import`. Start MCP
+   only after the import succeeds.
+2. Inspect posture with `tinycloud_status` or `tinycloud_auth_status`.
+3. Call `tinycloud_account_spaces_list` and
+   `tinycloud_account_applications_list`. If either returns
+   `authority_required`, give the exact structured request to the account
+   owner for `tc auth grant --stdin --yes`, then import the returned artifact
+   with `tinycloud_auth_import`.
+4. Choose a non-secrets space from those results. Use `tinycloud_kv_list` with
+   an exact space and prefix. Follow the same request, owner grant, import,
+   restart, and retry sequence when authority is required.
+5. Use `tinycloud_kv_get` for one exact returned key. A list grant does not
+   imply get authority; request and import the exact get grant when required.
+6. Do not broaden a path, substitute a sibling key, change the audience, or
+   use generic KV tools against a secrets space. Use `tinycloud_secrets_get`
+   for secrets.
+
+## Secret workflow
+
+1. Inspect posture first with `tinycloud_status` or `tinycloud_auth_status`.
+   Treat `delegate-session` as delegated authority even when its owner DID is
+   the target space owner. Do not infer owner authority from metadata.
+2. Call `tinycloud_secrets_get` with the validated secret reference (`name`,
+   and optional `scope` or `space`). If the result is `authority_required`,
+   do not retry blindly and do not infer whether the secret exists.
+3. Present the exact structured `request` and its exact `approval` OpenKey
+   action to the user for out-of-band approval. Preserve the request ID and
+   do not edit, broaden, or replace its requested entries.
+4. In a later call, use `tinycloud_auth_import` with the returned request ID
+   and the approved delegation artifact. A process restart is expected to be
+   safe. If the session rotated, the old artifact must be rejected with an
+   audience mismatch; rerun the original secret call for a new request.
+5. Retry the original `tinycloud_secrets_get` call after a successful import.
+   The successful structured result is authoritative. Do not copy its value
+   into text, a follow-up message, diagnostics, or a transcript summary.
+6. If the result is `setup_required`, show the structured Secret Manager setup
+   link. The link contains only the secret reference and target space; it never
+   contains a secret value.
+
+MCP hosts may retain tool arguments and successful results in their own
+transcripts, caches, or evaluation records. TinyCloud controls only its own
+logs and local profile state, not host-side transcript retention. Hosts should
+apply their own sensitive-result retention and access controls.
+
+This proving surface uses local stdio only. It has no continuation tool,
+resources, prompts, elicitation, remote transport, generic permission grant,
+or secret mutation tool.
+
+This is a beta surface. Delegated posture is the default; owner-profile data
+access requires explicit opt-in. The user must enter secrets only in Secret
+Manager, never in chat.